Getting Data In

BucketMover moving to cold on UNC

jrich523
Path Finder

I get the following error:

ERROR BucketMover - aborting move because recursive copy from src='C:\Program Files\Splunk\var\lib\splunk\f5test\warmdb\db_1380909713_1380904989_18' to dst='\10.20.120.120\Splunk\Node01\F5test\inflight-db_1380909713_1380904989_18' failed (reason='The operation completed successfully.')

I is indication successful but i check the folder and there is nothing there.

I logged in to the server (windows 2012 R2) as the service account that runs splunkd and checked to make sure access was ok and im able to create/read/write ok. Also it created the F5Test folder when i added the cold path to the index so its not an access issue.

I ran procmon to see if it showed anything and I can see it trying to access the path

1:42:54.2746637 PM splunkd.exe 1684 CreateFile \10.20.120.120\splunk\Node01\F5test\inflight-db_1380909713_1380904989_18 NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

So that seems normal, based on the fact that the file isnt there and it should be the Copy (CreateFile is used for a lot of things)

Is there something else i can do to look at why this might not be working?

thanks

0 Karma
1 Solution

jrich523
Path Finder

one part I left out, that was important to solving this was that i had moved the Warm files previously and it had screwed up the permissions so the problem was i didnt have access to move the local files. reset permissions and things started to move.

View solution in original post

jrich523
Path Finder

one part I left out, that was important to solving this was that i had moved the Warm files previously and it had screwed up the permissions so the problem was i didnt have access to move the local files. reset permissions and things started to move.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...